tensorlake@0.5.144 was backdoored with Shai-Hulud, targeting 14 crypto wallet extensions and credentials. Why CI skips it and how to isolate before token revocation.
The MALFEX malware campaign targeted Windows with 8 malicious npm packages executing via install scripts and require(). Known versions, bypasses of ignore-scripts, and lockfile inspection commands.
Aug 4, 2026: the keyv worm hit 12 unrelated orgs in 3h43m, and the poisoned builds carried valid GitHub Actions provenance. Why rotating credentials first is the thing that triggers the payload.
Checkmarx flagged 7 Vite-lookalike npm packages as ViteVenom. What actually triggers (bin/vite.js, not install), the Tron/Aptos/BSC C2 chain, and why npm v12 allowScripts and release-age gates don't stop it.
JFrog found 6 npm packages posing as Rollup polyfills. They install a second-stage package via CJS require(), not postinstall, then pull a RAT through JSONKeeper.
npm CLI 11.15.0 stages a tarball for maintainer 2FA approval before it hits the registry. Plus --allow-* install controls and how they differ from release-age gates and allowScripts.
postcss, nanoid and browserslist all ship from one npm account: 964M downloads/week, no provenance. Not a breach but a single-publisher risk — what moved to staged releases, and what to check in your lockfile.
Chainguard has blocked 52,000+ npm packages as malware or greyware, scanning 100,000+ a day, catching README-honest credential CLIs that release-age gates and npm v12 miss.
On June 17, 2026 Mastra's @mastra/* packages were re-published with an added easy-day-js dependency whose postinstall runs a RAT at install. Counts: 116 official vs 143–144 external.
npm v12 (July 2026) stops running dependency preinstall/postinstall and implicit node-gyp unless approved. How to list pending scripts with approve-scripts on npm 11.16, what allowScripts covers, and which supply-chain attacks it would have blocked.
GitHub disabled 73 Microsoft repos after an Azure/durabletask commit. Miasma used Claude Code, Gemini CLI, Cursor, and VS Code config, not npm install.
TrapDoor planted 34 packages across npm, PyPI and Crates.io to steal Solana/Sui/Aptos wallet keys. Each registry fires differently: postinstall, import-time, and Rust build.rs.
